Repository navigation
chore: bump netbird to 0.81.3 and keycloak to 26.8.1 - #150
Merged
Merged
Conversation
netbird: - appVersion 0.78.2 -> 0.81.3 (covers upstream 0.79.x-0.81.x). Notable: certificate posture checks, nblink, path-based reverse-proxy access control, X-Real-IP peer connection IPs behind reverse proxies. The combined-server config contract gained one purely additive optional key (reverseProxy.trustedPeers); dashboard env contract unchanged. No ports, protocols, or NB_* env vars changed; no manual DB migration. - Dashboard image v2.92.0 -> v2.95.0, paired with the 0.81.x cycle. - Upstream deprecated the MySQL store in 0.81.0 (removal planned); database.type=mysql keeps working and stays tested, documented as deprecated in the changelog. keycloak: - appVersion 26.7.4 -> 26.8.1 (upstream minor + security patch). 26.8.1 fixes ~20 CVEs incl. CVE-2026-94000 (manage-users -> realm-admin escalation), CVE-2026-94218 (2FA bypass), CVE-2026-96446 (PAR single-use bypass), CVE-2026-97846 (token-exchange mTLS bypass). None of the KC_* options this chart sets were removed or renamed; 26.8.0 persists login failures in the DB (schema migration plus non-blocking background index creation on first boot), noted in the chart changelog. Chart version fields are untouched; they are bumped by the release flow. Closes #144, #145, #146, #147, #148, #149 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mikkeldamsgaard
added a commit
that referenced
this pull request
Oct 20, 2026
Sync chart version with upstream appVersion 26.8.1 (bumped on main via #150). Security: ~20 upstream CVE fixes in 26.8.1. Keycloak 26.8 persists login failures in the DB (first-boot schema migration). Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Folds in all six open
autoreleaseissues.netbird 0.78.2 → 0.81.3, dashboard v2.92.0 → v2.95.0 (#144, #146, #148, #149)
Covers upstream 0.79.x–0.81.x: certificate posture checks, nblink, path-based reverse-proxy access control, and management reading
X-Real-IPfor peer IPs behind reverse proxies.render_combined_yamlbetween v0.78.2 and v0.81.3. One purely additive optional key (reverseProxy.trustedPeers); existing config stays valid.render_dashboard_envis unchanged.NB_*env vars changed; no manual DB migration.netbird-mysql-migrateprovided).database.type: mysqlstill works and the mysql e2e passed; recorded under Deprecated in the CHANGELOG so users can plan a migration.keycloak 26.7.4 → 26.8.1 (#145, #147)
An upstream minor plus a large security patch. 26.8.1 fixes ~20 CVEs, notably CVE-2026-94000 (
manage-users→ realm-admin escalation), CVE-2026-94218 (2FA bypass), CVE-2026-96446 (PAR single-use bypass), and CVE-2026-97846 (token-exchange mTLS binding bypass).KC_*option the chart sets against 26.8: none removed or renamed.jdbc-pingreceived an upstream bug fix.All three image tags verified to exist. Chart
versionfields are untouched; the release flow bumps them.Closes #144, #145, #146, #147, #148, #149
How to verify
🤖 Generated with Claude Code